fix: prefer ~/.hermes/.env over os.environ when seeding credential pool by franksong2702 · Pull Request #18256 · NousResearch/hermes-agent

franksong2702 · 2026-05-01T05:43:13Z

Summary

When _seed_from_env() reads API keys to populate the credential pool in auth.json, it was using get_env_value() which prefers os.environ over ~/.hermes/.env. This means stale env vars inherited from parent shell processes (Codex CLI, test scripts, etc.) can shadow deliberate changes to the .env file.

If a parent process exported OPENROUTER_API_KEY=test-key-fresh and the user later updates .env with a valid key, restarting Hermes still picks up the stale os.environ value, writes it back to auth.json, and all OpenRouter API calls silently fail with 401.

Changes

Added a local helper _get_env_prefer_dotenv() in _seed_from_env() that reads from ~/.hermes/.env (via load_env()) first, then falls back to os.environ
Replaced all 3 get_env_value() call sites in _seed_from_env() with the new helper
Added import os and load_env imports

Root Cause

get_env_value() in hermes_cli/config.py checks os.environ FIRST, then falls back to the .env file:

def get_env_value(key: str) -> Optional[str]:
    if key in os.environ:
        return os.environ[key]  # <-- takes priority over .env!
    env_vars = load_env()
    return env_vars.get(key)

This is a reasonable default for most call sites (runtime config), but for _seed_from_env() — which populates the persistent credential cache — the .env file should be authoritative. The credential cache already persists the snapshot, so the env var is only relevant during seeding; using a potentially stale os.environ value here defeats the purpose of the persistent cache.

Additional Discovery

During testing, another source of stale keys was identified: Hermes profile .env files at ~/.hermes/profiles/<name>/.env. These are created by hermes profile create --clone which copies the main .env at creation time. If the main .env had a test/stale key at that point, the profile retains it even after the main .env is updated. This is a separate concern from the os.environ priority issue, but users should be aware that profile .env files may also need manual sync when rotating keys.

Test Plan

Syntax verification: python3 -c "import py_compile; py_compile.compile('agent/credential_pool.py', doraise=True)"
Manual: set a key in .env, export a different value in shell, restart Hermes → should use .env value
Existing credential pool tests should pass

Related Issues

Closes #18254

When _seed_from_env() reads API keys to populate the credential pool, it should treat ~/.hermes/.env as the authoritative source — not os.environ. Stale env vars inherited from parent shell processes (Codex CLI, test scripts, etc.) can shadow deliberate changes to the .env file, causing auth.json to cache an outdated key that leads to silent 401 errors. This is especially visible with OpenRouter: if a parent process exported OPENROUTER_API_KEY=test-key-fresh and the user later updates .env with a valid key, restarting Hermes still picks up the stale os.environ value, writes it back to auth.json, and all API calls fail with 401. Fixes NousResearch#18254

Follow-up for PR #18256 salvage.

…cedence Covers PR #18256 fix for issue #18254 — when OPENROUTER_API_KEY is set in BOTH os.environ (stale from parent shell) and ~/.hermes/.env (fresh), _seed_from_env must prefer the .env value. Also guards the fallback case where .env omits the key entirely (Docker/K8s/systemd deployments that only inject via runtime env).

teknium1 · 2026-05-02T09:00:41Z

Merged via #18755 — your commit cherry-picked onto current main with authorship preserved via rebase-merge. Added regression tests for both the bug case (stale shell export shadowing fresh .env) and the fallback case (runtime-injected env in Docker/K8s deployments without a .env file). Thanks for the clean narrow fix!

#18755

Follow-up for PR NousResearch#18256 salvage.

…cedence Covers PR NousResearch#18256 fix for issue NousResearch#18254 — when OPENROUTER_API_KEY is set in BOTH os.environ (stale from parent shell) and ~/.hermes/.env (fresh), _seed_from_env must prefer the .env value. Also guards the fallback case where .env omits the key entirely (Docker/K8s/systemd deployments that only inject via runtime env).

Follow-up for PR NousResearch#18256 salvage.

…cedence Covers PR NousResearch#18256 fix for issue NousResearch#18254 — when OPENROUTER_API_KEY is set in BOTH os.environ (stale from parent shell) and ~/.hermes/.env (fresh), _seed_from_env must prefer the .env value. Also guards the fallback case where .env omits the key entirely (Docker/K8s/systemd deployments that only inject via runtime env).

Follow-up for PR NousResearch#18256 salvage.

…cedence Covers PR NousResearch#18256 fix for issue NousResearch#18254 — when OPENROUTER_API_KEY is set in BOTH os.environ (stale from parent shell) and ~/.hermes/.env (fresh), _seed_from_env must prefer the .env value. Also guards the fallback case where .env omits the key entirely (Docker/K8s/systemd deployments that only inject via runtime env).

Follow-up for PR NousResearch#18256 salvage.

…cedence Covers PR NousResearch#18256 fix for issue NousResearch#18254 — when OPENROUTER_API_KEY is set in BOTH os.environ (stale from parent shell) and ~/.hermes/.env (fresh), _seed_from_env must prefer the .env value. Also guards the fallback case where .env omits the key entirely (Docker/K8s/systemd deployments that only inject via runtime env).

Follow-up for PR NousResearch#18256 salvage.

…cedence Covers PR NousResearch#18256 fix for issue NousResearch#18254 — when OPENROUTER_API_KEY is set in BOTH os.environ (stale from parent shell) and ~/.hermes/.env (fresh), _seed_from_env must prefer the .env value. Also guards the fallback case where .env omits the key entirely (Docker/K8s/systemd deployments that only inject via runtime env).

Follow-up for PR NousResearch#18256 salvage.

…cedence Covers PR NousResearch#18256 fix for issue NousResearch#18254 — when OPENROUTER_API_KEY is set in BOTH os.environ (stale from parent shell) and ~/.hermes/.env (fresh), _seed_from_env must prefer the .env value. Also guards the fallback case where .env omits the key entirely (Docker/K8s/systemd deployments that only inject via runtime env).

alt-glitch added type/bug Something isn't working P1 High — major feature broken, no workaround area/auth Authentication, OAuth, credential pools comp/agent Core agent loop, run_agent.py, prompt builder labels May 1, 2026

alt-glitch mentioned this pull request May 1, 2026

fix(config): make ~/.hermes/.env authoritative over os.environ in get_env_value (#18254) #18298

Closed

This was referenced May 1, 2026

[Feature]: hermes auth sync — detect and fix credential drift across .env files and credential pool #18359

Open

Silent credential self-heal on 401: WebUI should fix auth.json drift without user intervention nesquena/hermes-webui#1401

Closed

teknium1 mentioned this pull request May 2, 2026

fix: prefer ~/.hermes/.env over stale os.environ when seeding credential pool (salvage #18256) #18755

Merged

teknium1 added a commit that referenced this pull request May 2, 2026

chore(release): map franksong2702 email for AUTHOR_MAP

9c626ef

Follow-up for PR #18256 salvage.

teknium1 closed this May 2, 2026

nickdlkk pushed a commit to nickdlkk/hermes-agent that referenced this pull request May 11, 2026

chore(release): map franksong2702 email for AUTHOR_MAP

0b6215d

Follow-up for PR NousResearch#18256 salvage.

jsboige pushed a commit to jsboige/hermes-agent that referenced this pull request May 14, 2026

chore(release): map franksong2702 email for AUTHOR_MAP

52ae8b2

Follow-up for PR NousResearch#18256 salvage.

dannyJ848 pushed a commit to dannyJ848/hermes-agent that referenced this pull request May 17, 2026

chore(release): map franksong2702 email for AUTHOR_MAP

17d8e6d

Follow-up for PR NousResearch#18256 salvage.

gweeteve pushed a commit to gweeteve/hermes-agent that referenced this pull request Jun 2, 2026

chore(release): map franksong2702 email for AUTHOR_MAP

b9213c8

Follow-up for PR NousResearch#18256 salvage.

Egavasyug pushed a commit to Egavasyug/hermes-agent that referenced this pull request Jun 10, 2026

chore(release): map franksong2702 email for AUTHOR_MAP

2a6f0c7

Follow-up for PR NousResearch#18256 salvage.

Seven74AI pushed a commit to Seven74AI/hermes-agent that referenced this pull request Jun 13, 2026

chore(release): map franksong2702 email for AUTHOR_MAP

d715e84

Follow-up for PR NousResearch#18256 salvage.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix: prefer ~/.hermes/.env over os.environ when seeding credential pool#18256

fix: prefer ~/.hermes/.env over os.environ when seeding credential pool#18256
franksong2702 wants to merge 1 commit into
NousResearch:mainfrom
franksong2702:fix/auth-json-credential-cache-invalidates-env

franksong2702 commented May 1, 2026 •

edited

Loading

Uh oh!

teknium1 commented May 2, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

franksong2702 commented May 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes

Root Cause

Additional Discovery

Test Plan

Related Issues

Uh oh!

teknium1 commented May 2, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

franksong2702 commented May 1, 2026 •

edited

Loading